Filebeat Does not read log files

Graylog Central (peer support)
1

Hello
Kubernetes has /var/log/container/ for logs of all containers and i want sent them to graylog, I installed “collector-sidecar” and Also I am sure it’s working for /var/log/*.log , but when i set path log to /var/log/container/ it stops sending logs … there is no error …

root@knode1:/var/log/containers# ls
busybox_default_busybox-e104e07f9a6a1c1a96ae7e4482b477f5ec64478c2b8630b218f34fbdad621973.log
busybox_default_busybox-ed0e770e155defd889179850e1fed6d7c05a7a1b1938e7872288b01e7977a291.log
elasticsearch-6579bdbdcc-9fhc2_default_elasticsearch-c0891866e12033b5e656b2fbb850b17522dab0a96d1a42d7c22b2e6a9931a4f3.log
kube-proxy-7ccfm_kube-system_kube-proxy-0143c6d6abaae721f9d9bb1c84a7966a8428fd990b7d94cc9565d091253f2f92.log
kube-proxy-7ccfm_kube-system_kube-proxy-c2c914173c3c03c87ac541771520e67fca542a69a3244926a96a7718b4d1b1fa.log

filebeat:
prospectors:

  • encoding: plain
    exclude_files:
    fields:
    collector_node_id: knode1
    gl2_source_collector: 387064e2-0fe3-42fb-a86e-36dcb21cc0d0
    type: log
    ignore_older: 0
    paths:
    • /var/log/containers/*.log
      scan_frequency: 10s
      tail_files: true
      type: log
      output:
      logstash:
      hosts:
    • 172.16.13.110:5044
      path:
      data: /var/cache/graylog/collector-sidecar/filebeat/data
      logs: /var/log/graylog/collector-sidecar
      tags:
  • container

Any Idea

2

is it /var/log/containers/*.log or /var/log/container/*.log ?

3

You need to supply Filebeat with a glob pattern, so /var/log/containers/*.log - then it’ll grab it.

4

It’s /var/log/containers/*.log

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.